UAC and You

[Mystere]

I've seen a lot of messages on this forum suggesting that people turn off UAC, calling it "useless" and "annoying". While if that's really what you want to do, then so be it... but I believe most people that advocate this don't really understand the ramifications of what they're doing.

Disabling UAC doesn't simply make the dialog go away. It completely changes the way Vista and 7 operate. Important security features like Internet Explorer Protected Mode no longer function (this is a mode in which even if there is a vulnerability found in IE, no external program will be able alter your system).

Another feature that's disabled is called folder virtualization. This is what allows programs that assume they have administrative permissions to write to protected areas (like Program Files) to continue to function. If you turn off UAC you will find a LOT more problems with older software compatibility.

Finally, turning off UAC rips the wings off angels, endangers kittens, and creates an unhealthy work environment for your puppies.

Learn to live with UAC. Once your system is setup, you will almost never see it (especially on 7). You will be safer, your system will have fewer problems, and you'll learn to love the atomic bomb.

And please, for the love your dear and fluffy lord, do NOT tell people to disable UAC if you really don't fully understand what doing that does.

 

[swarfega]

I leave mine untouched, its there for a purpose. Mind you Im using full administrator account.

 

[Orbital Shark]

Never seen any need to turn UAC off. Thankfully in Seven, the notifications aren't as frequent as in vista (accessing Device Manager is just 1 example)

 

[garbanzo]

paranoid much?

i ran XP for 8 years before switching to 7. XP had no UAC, i yet somehow i survived. i have UAC off in 7, and i continue to survive.

it's really not hard to operate a safe computing environment. as long as you operate a strict firewall and virus protection, keep an eye on running processes, and scan your system regularly, there is no need to worry. and i'm a very heavy downloader, i probably acquire an average of 50gb/month in various forms of data, often from unfamiliar sources. and i'm not daft enough to open spam email attachments, or to think that music comes in .exe files...

i've had to format my machine once in my life because of a bug, and i'm not even 100% certain the problem was on my machine - it was more a safety precaution than anything.

anyway, UAC does not play well with 3rd party file managers, and i'm not about to switch back to using explorer!

 

[Barman58]

UAC would work a lot better with 3rd party applications if their developers were not lazy and learned to program for a standard user. This has been a requirement for windows applications since the introduction of windows NT.

The visualization feature of UAC is another attempt to ensure that applications work OOB even when developers insist in storing data in inappropriate system areas

One of the major reasons for Microsoft introducing UAC in vista was to give these developers a nudge in the right direction. It is not a security device as such but a convenience to users.

The accepted method of operation for many years on professional systems is to run as a standard user at all times and to log in as an administrator only when performing system maintenance. The provision of the RUN-as mechanism and now the automatic RUN-as provided by UAC is a great step forward in usability for anyone who learned their trade on secure systems.

 

[Charles Kane]

I like it - I have it turned down (don't dim) - after reading all the complaints since Vista - I'm surprised.
Happy not to be running a firewall tho!

 

[intwtl]

Norton has the UAC tool for Vista that eliminates many of the UAC Popups.

I haven't tried in on 7 but it stands to reason there will be something along the same lines soon.

 

[harpua]

I would like to run UAC in 7 but cannot b/c I'm running programs that have unsigned drivers, that have to be signed by me using a special app and that requires the system to be run in test mode and also that UAC be turned off.

I have good security apps installed, use common sense, and haven't experienced any problems running w/o UAC, however.

 

[Wurstsalat]

I would like to run UAC in 7 but cannot b/c I'm running programs that have unsigned drivers, that have to be signed by me using a special app and that requires the system to be run in test mode and also that UAC be turned off.

no program needs to turn off uac
testmode with uac is no problem and if you need privileges for your bull program use the application compatbility toolkit

I have good security apps installed, use common sense, and haven't experienced any problems running w/o UAC, however.

oh i have the pimp me security app...and have no problems with security

just bull, the security apps dont give you features like the protected mode. Great that you havent any problems in the past...the future security problems will be the same


i agree 100% to the topic starter

 

[garbanzo]

seriously, what's the worst that can happen?

if something goes wrong, i reinstall windows. half the people here are doing that once a week as these new builds leak out. it's not a big deal.

 

[Charles Kane]

half the people here are doing that once a week as these new builds leak out. it's not a big deal.

What you say makes sense.
But at least part of the problem is the OTHER half. They aren't up to it, or its too time consuming (especially in a work/business environment), or its just a hassle that can (largely) be avoided. (PS CS4 take more than 25mins for me to install - alone)

Also there is a small propagation problem.

I'd be happy ditching my AV, but really it hardly impinges on my life at all so why bother. With 7 I HAVE ditched any 3rd party firewall so a 2 second interference from UAC every now and again doesn't trouble me - it also keeps me aware of the OS which really I don't mind.

 

[garysgold]

True, providing you do nothing important on your computer like entering credit card info to buy something. We had a guy over at Vista that was telling us how smart he was and didn't use UAC. A few days later his personal files were corrupt, he couldn't do anything with his computer except reformat and start over. Everyone whines they want more security and when it comes along they whine about that. Security means less usability. No way around that. IMO, UAC is a good mix of the two and much better than having to log into an admin acct. every time I want to change a setting. With todays crackers out there, it's no longer a matter of if you will be attacked, but how often. JMHO.

 

[OEM]

This seems to be getting a lot of play lately. lol

I too agree that the UAC is not that big of a deal with Windows 7, Vista though is a different story. Whats one more click in a day filled with probably hundreds of clicks.

If you want to keep the UAC on as I do, but want to allow some programs that require the UAC prompt to run without it, check this tutorial out.

http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html

 

[Mystere]

paranoid much?

i ran XP for 8 years before switching to 7. XP had no UAC, i yet somehow i survived. i have UAC off in 7, and i continue to survive.

First, Malware attacks are far more sophisticated today than they were 8 years ago. They often combine multiple vectors. However, security is only half of what UAC does (I notice you ignored the other part of it).

Some apps require UAC. And the problem is that once you turn UAC off, you let apps walk all over the OS, thus turning it back on again causes more problems because the apps have already writen their files in places they now can't access.

Lastly, as I said originally. If you understand everything that UAC does and the ramifications of turning off UAC then be my guest. The problem is the people who turn it off without even knowing what they're disabling by doing so.

 

[Mystere]

To the admins that moved this post to System Security, I don't think this belongs there. That's why I posted it in General Discussion. UAC is only partially a security mechanism. It's also a usability mechanism.

More importantly, I think the discussion should be read by everyone, not only those who venture into the Security forum. The post was precisely made for the benefit of those that don't really understand security, and thus those people aren't likely to come into Security board.

Of course I doubt the admins will read this, which kind of illustrates my point.

 

[Charles Kane]

People will find this better here than in general - because it IS security. If they are interested in UAC they'll find it. Otherwise they won't read it anyway.
No need to be presumptuous - the same admins who moved it will pretty certainly see your latest post (and ignore it).
You may see yourself as a teacher with really important info - but like it or not others may not want to enroll in your class. And this isn't YOUR school anyway.
You posted good stuff. Most agreed. Attraction works better than imposition.

 

[Mystere]

People will find this better here than in general - because it IS security.

No, it's only partially security.

But that's not the point. Your argument is similar to someone saying "The directions to the cafeteria should only be posted in the Cafeteria itself because that's what it's about." This ignores the fact that if you don't know where the cafeteria is in the first place, you can't find the directions.

The people who are regular security forum readers will already know most of the issues with UAC. So it defeats the purpose to post such information where all the people reading it already know it.

 

[Burgurne]

No, it's only partially security.

But that's not the point. Your argument is similar to someone saying "The directions to the cafeteria should only be posted in the Cafeteria itself because that's what it's about." This ignores the fact that if you don't know where the cafeteria is in the first place, you can't find the directions.

The people who are regular security forum readers will already know most of the issues with UAC. So it defeats the purpose to post such information where all the people reading it already know it.

I have to agree on that. If the headline in "General discission" was not there I would never ahve seen this threa

 

[Charles Kane]

I hear you. I hope your information is widely known. As far as I can tell "don't turn off" UAC is widely supported by the Team Members and Gurus and in their posts throughout the site.

 

[Sven]

Burgurne is right. That's go for me too. I normally check "generel" and "gaming" and "drivers" as I'm just a normal PC-gamer, and I don't know enough of the deeper inside in Windows to begin fiddle around. UAC was indeed one of the things I have been thinking of turning off, but some nice people inhere has learned me some tricks to starts my favorit-programs without warnings allthough UAC is turned on.
Again, if this thread was not in "Generel" I would easely have overlooked it, and then I might ended up turning it off, without knowing how much else, that would have been "out of order".
I gave a click to Charles Kane's reputation for this one.

With all that said, I can see why staff moved this thread to "security", because else the "generel" would be flooded. Nice thing though, they do leave a link in "generel" so us, that is not so clever, still can find the info.